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(U)  Additional  Copies 

To  obtain  copies  of  this  report,  contact  the  Secondary  Reports  Distribution  Unit  at  (703) 
604-8937  (DSN  664-8937)  or  fax  (571)  372-7469. 

(U)  Suggestions  for  Audits 

To  suggest  or  request  audits,  contact  the  Office  of  the  Deputy  Inspector  General  for 
Auditing  by  phone  (703)  604-9142  (DSN  664-9142),  by  fax  (571)  372-7469,  or  by  mail: 

Department  of  Defense  Office  of  Inspector  General 
Office  of  the  Deputy  Inspector  General  for  Auditing 
ATTN:  Audit  Suggestions/1 3F25 -04 
4800  Mark  Center  Drive 
Alexandria,  VA  22350-1500 
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To  report  fraud,  waste,  mismanagement;  and  abuse  of  authority. 

Send  written  complaints  to:  Defense  Hotline.  The  Pentagon,  Washington  DC  20301-1900 
Phone:  800.424.9098  e-maii:  hotline@dodlg.roll  www, dodig.mil/hotline 
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Base  Defense  Operations  Center 
U.S.  Central  Command  Joint  Theater  Sustainment 
Contracting  Command 
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Entry  Control  Point 
Joint  Security  Station 
Office  of  Security  Cooperation-Iraq 
Private  Security  Contractor 
Performance  Work  Statement 
Rules  for  the  Use  of  Force 
Standard  Operating  Procedures 
Strategic  Security  Services-Iraq 
Theater  Wide  Internal  Security  Services 
U.S.  Central  Command 
U.S.  Forces-Iraq 
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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
4800  MARK  CENTER  DRIVE 
ARLINGTON,  VIRGINIA  22350-1500 


April  16,2012 


MEMORANDUM  FOR  COMMANDER,  U.S.  CENTRAL  COMMAND 

U.S.  AMBASSADOR  TO  IRAQ 

AUDITOR  GENERAL,  DEPARTMENT  OF  THE  ARMY 

SUBJECT:  (U)  DoD  Oversight  of  Private  Security  Contractors  in  Iraq  Was  Sufficient,  hut 

Contractors  May  Not  Deter  Attacks  on  Office  of  Security  Cooperalion-Iraq  Enduring 
Sites  (Report  No.  DODIG-20 12-075) 

We  are  providing  this  report  for  your  review  and  comment.  DoD  officials  provided 
sufficient  oversight  of  private  security  contractors  in  Iraq;  however,  those  contractors  may  not 
deter  attacks  at  the  Office  of  Security  Cooperation- Iraq  enduring  sites.  Specifically,  at  5  of  30 
installations  using  PSC  guards,  U.S.  military  commanders  supplemented  the  guards  with  military 
personnel  during  times  of  heightened  threat.  In  addition,  the  Security  Support  Services-Iraq 
contract,  which  provides  private  security  contractor  services  at  the  enduring  sites,  removes  the 
private  security  contractors'  responsibility  to  defend  the  enduring  sites.  We  considered 
management  comments  on  a  draft  of  this  report  when  preparing  the  final  report. 


(U)  DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly.  The 
Executive  Director,  U.S.  Army  Contracting  Command- Rock  Island  responded  for  the 
Commander,  U.S.  Central  Command.  However,  the  comments  were  partially  responsive  and  did 
not  indicate  agreement  or  disagreement  with  the  findings  and  recommendation;  therefore,  we 
request  additional  comments  by  May  16,  2012. 

(U)  If  possible,  send  management  comments  in  electronic  format  (Adobe  Acrobat  file  only). 
Copies  of  management  comments  must  have  the  actual  signature  of  the  authorization  official  for 
your  organization.  We  are  unable  to  accept  the  /Signed/  symbol  in  place  of  the  actual  signature. 
If  you  arrange  to  send  classified  comments  electronically,  you  must  send  them  over  the  SECRET 
Internet  Protocol  Router  Network  (SIPRNET). 


(U)  We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  604-8905. 


Amy  U,  /j^rontz,  /y 
Principal  AssistanHnspector  General 
for  Auditing 


cc: 

Commander,  Joint  Theater  Support  Contracting  Command 
Executive  Director,  U.S.  Army  Contracting  Command-Rock  Island 
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(U)  DoD  Oversight  of  Private  Security 
yjjjrJ  Contractors  in  Iraq  Was  Sufficient,  but 
^  Contractors  May  Not  Deter  Attacks  on  Office 
of  Security  Cooperation-1  raq  Enduring  Sites 


(U)  What  We  Did 

(U)  Our  objective  was  to  determine  whether  DoD 
adequately  administered  and  managed  private 
security  contractors  (PSCs).  Specifically,  we 
evaluated  contract  requirements  and  related  security 
control  measures  and  procedures  for  access  to  U.S. 
military  installations  in  Iraq.  We  identified  concerns 
related  to  the  future  role  of  PSCs  in  Iraq;  therefore, 
we  evaluated  the  private  security  contract 
requirements  for  the  Office  of  Security 
Cooperation-Iraq  (OSC-I)  enduring  sites. 

(U)  What  We  Found 

(U)  DoD  officials  adequately  administered  and 
provided  oversight  of  PSCs  at  Victoiy  Base 
Complex  and  Forward  Operating  Base  Hammer.  In 
addition,  U.S.  Forces-Iraq  had  adequately  planned 
for  the  use  of  PSCs  during  the  withdrawal  of  U.S. 
forces  from  Iraq.  As  a  result,  we  identified  only 
minor  concerns  related  to  training  requirements  and 
weapons  qualifications. 

However,  the  PSC  guards  did  not  always  deter 
insurgents  from  attacking  military  installations  in 
Iraq  as  the  security  requirements  in  the  private 
security  contract  were  not  adequate.  Specifically, 
U.S.  military  commanders  at  5  of  30  installations 
using  PSC  guards  supplemented  the  guards  with 
military  personnel  during  times  of  heightened  threat. 
In  addition,  PSC  guards  did  not  return  fire  on 
insurgents  during  two  separate  attacks. 

^  The  U.S.  military  augmentation  occurred 
because  the  PSC  staffing  level  is  based  on  the  threat 
level  at  the  time  the  contract  is  awarded  and  does  not 
allow  increased  staffing  commensurate  with  the 
changes  in  the  threat  level  without  a  contract 
modification.  In  addition,  contract  restrictions  and 


international  agreements  limited  the  PSCs’ 
ability  to  react  to  threats  and  place  the  PSC  guards 
under  Iraqi  jurisdiction  for  acts  considered  to  be 
criminal,  which  may  cause  the  guards  to  delay  in 
returning  fire  on  insurgents.  As  a  result, 

U.S.  Govermnent  and  contractor  personnel  and 
assets  will  likely  be  at  an  increased  risk. 

Military  officials  expressed  concern  that  once 
the  U.S.  military  completes  its  withdrawal,  the  PSCs 
may  not  be  able  to  deter  attacks  on  the  OSC-I 
enduring  sites  in  Iraq,  putting  U.S.  personnel  and 
assets  at  increased  risk.  In  addition,  the  Security 
Support  Services-Iraq  contracts  that  will  provide 
PSC  services  at  OSC-I  enduring  sites  removes  the 
contractor  responsibility  to  defend  the  sites  against 
attacks,  further  exacerbating  the  security  risks  at  the 
enduring  sites. 

(U)  What  We  Recommend 

(U)  The  Commander,  U.S.  Central  Command, 
should  modify  the  Security  Support  Services-Iraq 
contract  to  include  a  surge  capability  to  allow  the 
private  security  contractors  to  respond  to  changing 
threat  levels,  provide  additional  guidance  and 
examples  of  what  is  considered  an  imminent  threat, 
and  clarify  the  guards’  responsibility  to  engage  the 
enemy  when  attacked. 

(U)  Management  Comments 
and  Our  Responses 

(U)  The  Executive  Director,  U.S.  Army  Contracting 
Command-Rock  Island  responding  for  the 
Commander,  U.S.  Central  Command,  did  not 
indicate  agreement  or  disagreement  with  the  findings 
and  the  comments  were  partially  responsive. 
Therefore,  we  request  additional  comments  by 
May  16,  2012.  Please  see  the  recommendation 
table  on  the  back  of  this  page. 
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(U)  Introduction 

(U)  Objective 

(U)  Our  objective  was  to  determine  whether  DoD  adequately  administered  and  managed 
private  security  contracts  during  the  drawdown  of  U.S.  forces  from  Iraq.  Specifically,  we 
evaluated  contract  requirements  and  related  security  control  measures  and  procedures  for 
access  to  U.S.  military  installations  in  Iraq.  We  focused  on  the  primary  concern  of  safety 
and  security  at  U.S.  installations  in  Iraq  and  limited  our  review  to  the  contractors’ 
performance  in  meeting  security  requirements  outlined  in  the  contracts.  We  did  not  review 
other  financial  aspects  of  contract  administration  and  oversight.  We  identified  concerns 
related  to  the  future  role  of  private  security  contractors  (PSCs)  in  Iraq;  therefore,  we 
evaluated  the  private  security  contract  requirements  for  the  Office  of  Security 
Cooperation-Iraq  (OSC-I)  enduring  sites.  See  Appendix  A  for  a  discussion  of  our  audit 
scope  and  methodology. 

(U)  Background 

(U)  DoD  uses  PSCs  tor  static  base  defense  and  mobile  security.  In  Iraq,  static  base 
defense  includes  manning  guard  towers  and  entry  control  points  and  providing  security  for 
specified  internal  locations,  such  as  dining  facilities  and  base  exchanges.  Mobile  security 
includes  convoy  escorts  and  personnel  protection  details.  For  this  audit,  we  reviewed  static 
base  defense  only.  As  of  May  201 1,  PSCs  provided  security  at  33  U.S.  installations  in  Iraq 
as  shown  in  Figure  1. 
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(U)  Theater  Wide  Internal  Security  Services  Contract 

(U)  DoD  contracted  for  PSC  services  in  Iraq  through  task  orders  placed  against  the 
Theater  Wide  Internal  Security  Services  (TWISS)  multiple  award  contracts.  The  TWISS 
contracts  are  indefinite-delivery,  indefinite-quantity  contracts,  and  were  awarded  to  four 
companies  (Triple  Canopy,  EOD  Technology  [EODT],  Torres,  and  Special  Operation 
Consulting  [SOC]).  As  of  May  2011,  approximately  $582  million  was  obligated  against 
the  TWISS  contracts.  See  the  below  table  for  a  list  of  the  TWISS  contracts,  task  orders, 
and  obligations. 


(U)  Table.  TWISS  Contracts,  Task  Orders,  and  Obligations 


Contractor 


Triple  Canopy 


EODT 


EODT 


Torres 


SOC 


Triple  Canopy 


Total 


Contract  Number 


W9 1 GD W07D4022  j 


J  W91GDW07D4027 


W9 1  GD W09D4029  • 


W91GDW09D4030  j 


W91 GDW09D403 1 


W91GDW09D4033 


Task  Orders  | 

Obligations 

14 

$ 

99,262,193.11  j 

13  | 

$ 

128,304,089.02  j 

11 

$ 

13,172,943.35  ! 

15 

$ 

58,407,338.00  | 

17 

$ 

224,364,069.73  j 

11 

$ 

58,424,473.22  j 

81 

$ 

581,935,106.43  1 
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(U)  The  TWISS  contracts  required  the  PSCs  to  provide  all  labor,  weapons,  equipment,  and 
other  essential  resources  to  supplement  security  operations  in  the  Iraqi  theater  and 
“enforced  the  respective  force  protection  commander’s  security  rules  and  regulations.” 

The  contracts  identified  the  requirements  for  each  specific  type  of  labor,  including  the 
amount  and  frequency  of  PSC  guard  training.  The  contracts  also  provided  information 
about  recruiting  and  vetting  prospective  PSC  employees,  as  well  as  legal  jurisdiction  of  the 
PSC  workforce.  The  TWISS  contracts  provided  PSC  security  through  the  withdrawal  of 
U.S.  forces  from  Iraq.  As  the  enduring  installations  transition  to  the  OSC-I  between 
October  201 1  and  December  2011,  PSC  security  services  will  be  provided  by  the 
Security  Support  Services-Iraq  (SSS-1)  contracts. 

(U)  Responsible  Organizations 

(U)  Several  DoD  organizations  are  responsible  for  the  development,  management,  and 
oversight  of  the  PSC  contracts.  Those  organizations  include  the  U.S.  Central  Command 
(USCENTCOM),  U.S.  Forces-Iraq  (USF-I),  USCENTCOM  Joint  Theater  Support 
Contracting  Command  (C-JTSCC),  and  Defense  Contract  Management  Agency-Iraq 
(DCMA-I). 

(U)  U.S.  Central  Command 

(U)  USCENTCOM  is  responsible  for  developing  and  issuing  policies,  directives, 
instructions,  and  other  forms  of  guidance  that  direct  the  use  of  PSCs.  The  guidance 
includes  the  rules  for  the  use  of  force  (RUF),  which  dictate  when  the  PSCs  are  authorized 
to  use  deadly  force  in  response  to  threats.  While  the  use  of  deadly  force  is  authorized  in 
self  defense  or  the  defense  of  others  without  a  graduated  response,  the  RUF  requires  the 
PSCs  to  follow  a  graduated  response  in  other  situations.  A  graduated  response  requires  the 
PSCs  to  give  verbal  and  visual  warnings,  demonstrate  the  intent  to  use  their  weapons,  and 
attempt  to  physically  prevent  access.  Only  after  following  these  steps  are  the  PSC  guards 
authorized  to  use  deadly  force. 

(U)  U.S.  Forces-Iraq 

(U)  Before  December  2011,  the  USF-I  was  the  USCENTCOM  subordinate  command 
responsible  for  U.S.  military  operations  in  Iraq.  USF-I  issued  security-related  operations 
orders  based  on  USCENTCOM  direction,  gathered  intelligence,  and  other  military 
guidance.  The  operations  orders  were  disseminated  through  the  division  level  to  the  Base 
Defense  Operations  Center  (BDOC)  at  each  Iraq  installation.  The  BDOC  was  responsible 
for  installation  security  and  could  alter  the  security  requirements,  based  upon  the  threat 
level.  BDOC  officials  coordinated  with  the  PSCs  to  fulfill  security  protection 
requirements. 

(U)  USCENTCOM  Joint  Theater  Support  Contracting  Command 

(U)  C-JTSCC  provided  operational  contracting  support  for  U.S.  forces  in  Iraq.  C-JTSCC 
developed  and  awarded  the  PSC  contracts,  but  delegated  the  contracts  administration  and 
oversight  duties  to  DCMA-I. 
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(U)  Defense  Contract  Management  Agency-iraq 

(U)  DCMA  is  the  DoD  component  that  works  directly  with  Defense  suppliers  to  help 
ensure  that  DoD,  Federal,  and  allied  Government  supplies  and  services  are  delivered  on 
time,  at  projected  cost,  and  meet  all  performance  requirements.  DCMA-I  provided  PSC 
contract  administration  and  oversight  to  ensure  that  the  contractor  complied  with  contract 
requirements  and  USCENTCOM  guidance  and  also  ensured  that  the  U.S.  Government 
fulfilled  its  contract  obligations. 

(U)  Review  of  Internal  Controls 

(U)  DoD  Instruction  5010.40,  “Managers’  Internal  Control  Program  (MICP)  Procedures,” 
July  29,  2010,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  that  provide  reasonable  assurance  that  programs  are  operating  as  intended 
and  to  evaluate  the  effectiveness  of  the  controls.  We  did  not  identify  any  internal  control 
weaknesses  related  to  the  management  and  oversight  of  the  two  PSCs  we  reviewed.  The 
internal  controls  were  in  place  and  operating  as  intended.  At  both  sites  visited,  the 
contracting  officer  representatives  (CORs)  and  DCMA-I  quality  assurance  representatives 
performed  monthly  reviews  of  the  contractor’s  performance,  and  these  inspections  were 
sufficient  to  ensure  the  contractor  was  performing  as  required  by  the  contract.  Therefore, 
the  U.S.  military  officials’  ability  to  provide  additional  security  during  periods  of 
heightened  threat  mitigated  the  security  risks  related  to  the  inability  of  the  PSC  guards  to 
surge  when  required.  However,  after  the  withdrawal  of  U.S.  forces  from  Iraq,  if  a  surge  is 
necessary,  the  PSCs’  inability  to  adjust  to  threat  levels  will  be  a  security  weakness.  The 
recommendation  in  this  report  could  help  prevent  this  weakness  from  occurring.  We  will 
provide  a  copy  of  this  report  to  the  senior  officials  responsible  for  internal  controls  in  the 
U.S.  Central  Command  and  the  U.S.  Embassy  Iraq. 


SECRET 

4 


SECRET 


(U)  Finding  A.  DoD  Oversight  of  Private 
Security  Contractors  in  Iraq  Was  Sufficient 

(U)  DoD  officials  adequately  administered  and  provided  oversight  of  PSCs  at  Victory 
Base  Complex  and  Forward  Operating  Base  Hammer.  Specifically,  CORs,  BDOC 
personnel,  and  DCMA-I  officials  adequately  monitored  the  PSCs  performance  to  ensure 
that  the  contractors  were  in  compliance  with  contractual  and  BDOC-established  security 
requirements,  security  control  measures,  and  procedures  for  access  to  U.S.  military 
installations  in  Iraq.  In  addition,  USF-I  adequately  planned  for  the  use  of  PSCs  during  the 
withdrawal  of  U.S.  forces  from  Iraq.  As  a  result,  we  identified  only  minor  concerns  related 
to  training  requirements  and  weapons  qualifications. 

(U)  Compliance  With  Contract  Requirements 

(U)  The  PSCs  at  Victory  Base  Complex  and  Forward  Operating  Base  Hammer  complied 
with  contract  requirements  for  performance. 

Specifically,  the  contract  and  associated  task  orders 
contained  requirements  for  the  development  of  standard 
operating  procedures  (SOPs),  guard  training,  and 
manning  tables  outlining  the  positions  and  duties  of  the 
guards.  At  both  bases,  PSC  personnel  developed  SOPs 
that  identified  duties  and  explained  expectations  for 
each  work  task.  PSC  personnel  also  performed  all 
contract-required  training.  During  our  site  inspections,  we  did  not  identify  any  deviance 
from  the  manning  requirements  or  duties  performed  at  the  guard  towers  and  Entry  Control 
Points  (ECPs). 

(U)  Standard  Operating  Procedures 

(U)  The  contract  and  task  orders  required  the  contractor  to  develop  SOPs  that  cover 
vehicular  screening  and  entry  control  procedures.  We  reviewed  the  SOPs  and  determined 
they  were  reasonable  and  compliant  with  contractual  terms  and  conditions.  The  SOPs  at 
Victory  Base  Complex  and  Forward  Operating  Base  Hammer  included  specific 
instructions  for  the  PSC  guards  at  the  perimeter  towers  and  ECPs.  The  perimeter  tower 
SOPs  detailed  the  responsibilities  performed  at  each  tower,  the  place  of  performance,  the 
weapons  and  communication  equipment  needed,  weapon  conditions,  RUF  requirements, 
and  expected  guard  reaction  to  indirect  fire.  The  ECP  SOPs  detailed  the  responsibilities 
performed  at  the  ECP,  the  equipment  ECP  personnel  should  have  at  the  ECP  and  on  their 
person,  weapon  conditions,  RUF,  procedures  for  personnel  searches,  and  procedures  for 
vehicle  searches. 

(U)  PSC  Training 

(U)  The  contracts  outlined  required  training  for  the  PSCs,  including  instructions  on  first 
aid,  emergency  response  procedures,  the  Law  of  Armed  Conflict,  RUF,  prevention  of 
sexual  harassment,  General  Order  Number  1,  Trafficking  in  Persons,  and  weapons  training 
and  qualification.  In  most  cases,  PSC  personnel  ensured  that  security  guards  received 
training  in  accordance  with  contractual  terms  and  conditions. 


(U)  The  PSCs  at  Victoty 
Base  Complex  and 
Forward  Operating  Base 
Hammer  complied  with 
contract  requirements 
for  performance. 
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(U)  During  our  review  of  a  statistical  sample  of  147  training  records  at  Victoiy  Base 
Complex,  we  found  no  major  concerns,  and  identified  no  more  than  1 0 1  of  the  ex-patriot 
guards  with  expired  training.  We  did  not  identify  any  third-country  national  guards  with 
expired  training.  We  identified  one  ex-patriot  and  four  third  country  nationals  without  a 
current  weapon  qualification.  We  did  not  project  the  sample  results  for  the  weapons 
qualification  because  not  all  positions  require  PSCs  to  carry  a  weapon.  We  viewed  the 
expired  training  to  be  a  minor  administrative  concern,  and  during  the  audit,  contractor 
personnel  took  immediate  action  to  ensure  the  PSC  guards  took  the  required  training  and 
qualified  on  their  weapons.  Finally,  we  identified  no  more  than  21  ex-patriots  and  no  more 
than  91 2  of  the  third-country  nationals  who  are  missing  personnel  files. 

(U)  We  reviewed  the  files  for  all  1 1  ex-patriots  and  154  third-country  nationals  at  Forward 
Operating  Base  Hammer,  We  identified  two,  third-country  nationals  with  expired  weapons 
qualifications.  However,  not  all  positions  require  the  guard  to  carry  a  weapon,  so  we 
viewed  this  as  a  minor  problem.  We  were  unable  to  determine  if  1  ex-patriot  and 
78  third-country  nationals  were  current  in  their  Trafficking  in  Persons  training  because  of 
issues  identifying  the  exact  date  the  training  was  administered.  We  viewed  the  potentially 
expired  training  as  a  minor  administrative  concern  which  was  addressed  during  the  audit. 
The  PSC  manager  stated  that  the  Trafficking  in  Persons  training  would  be  provided  to 
ensure  training  was  up  to  date. 

(U)  Manning  of  Towers  and  ECPs 

(U)  We  observed  security  guards  effectively  performing  their  duties  at  perimeter  towers 
and  ECPs  on  Victory  Base  Complex  and  Forward  Operating  Base  Hammer.  After 
reviewing  the  contracts  and  SOPs  for  each  PSC,  we  created  a  checklist  to  use  in  inspecting 
the  perimeter  towers  and  ECPs  at  both  bases.  Because  of  the  high  security  threat  and  the 
risk  of  impeding  security  operations,  we  could  not  review  all  areas  of  the  ECPs.  However, 
we  reviewed  required  documents  and  observed  equipment  in  the  perimeter  towers,  along 
with  security  control  measures  and  procedures  for  access  to  the  U.S.  military  installations 
at  the  ECPs.  We  also  verified  that  the  PSCs  submitted  manning  reports  before  placing 
guards  on  duty  as  required  by  the  contract. 

(U)  Adequate  Government  Oversight 

(U)  We  found  that  the  COR,  BDOC  personnel,  and  DCMA-I  officials  performed  adequate 

oversight  of  PSCs.  The  oversight  included  inspections 
performed  by  the  COR  and  BDOC  personnel,  and  quality 
assurance  reviews  performed  by  DCMA-I  officials.  The 
inspections  and  reviews  covered  all  aspects  of  the  PSCs’ 
performance  and  included  reviews  of  armed  contractor 
documentation  requirements,  performance  at  ECPs  and 
towers,  daily  manning  reports,  and  inspections  of  weapons  and  ammunition.  The  COR  and 


(U)  The  inspections 
and  reviews  covered 
all  aspects  of  the 
PSCs  ’  performance . . . 


1  (U)  See  Appendix  C  for  a  full  discussion  of  the  statistical  sample  of  the  10  ex-patriots  with  expired 
training. 

2  (U)  See  Appendix  C  for  a  lull  discussion  of  the  statistical  sample  of  the  21  ex-patriots  and  91  third-country 
nationals  missing  personnel  files. 
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(U)  BDOC  personnel  submitted  inspection  results  to  DCMA-I  officials  for  review.  At 
Victory  Base  Complex,  the  COR’s  primary  duty  was  to  review  and  inspect  PSCs,  and  this 
enabled  him  to  perform  extensive  reviews  of  the  PSC’s  performance  and  conduct. 

(U)  Use  of  PSCs  During  Iraq  Drawdown 

(U)  USF-I  officials  adequately  planned  for  the  use  of  PSCs  during  the  withdrawal  of 
U.S.  forces  from  Iraq.  According  to  the  security  agreement  between  the  U.S.  Government 
and  the  Government  of  Iraq,  U.S.  forces  will  transition  out  of  Iraq  by  December  2011. 
While  the  majority  of  installations  currently  occupied  by  the  U.S.  forces  will  be  turned 
over  to  the  Government  of  Iraq,  a  few  installations,  called  enduring  sites,  will  remain  under 
the  control  of  the  OSC-I  and  the  U.S.  Department  of  State.  According  to  C-JTSCC 
contracting  officials,  the  manner  in  which  security  is  provided  during  the  drawdown  of 
U.S.  forces  at  each  location  will  be  based  on  the  future  status  of  the  installation.  Figure  2 
identifies  the  enduring  sites. 


(U)  Figure  2.  Enduring  Sites  in  Iraq 
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(U)  Non-Enduring  Sites 

(U)  At  sites  to  be  transferred  to  the  Government  of  Iraq,  all  U.S.  property,  personnel, 
contractors,  and  contractor  property  must  be  removed  or  accounted  for  before  the  transfer 
of  the  installation.  According  to  C-JTSCC  contracting  officials,  PSC  services  will  be 
terminated  in  the  final  few  days  or  weeks  before  the  transfer,  during  which  time  the 
installation  will  be  secured  by  U.S.  military  personnel.  The  C-JTSCC  contracting  official 
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(U)  stated  that  this  will  maintain  the  level  of  security  required  to  protect  the  U.S. 
Government  and  contractor  personnel  and  assets  while  allowing  the  PSCs  sufficient  time 
to  remove  their  equipment  and  personnel  before  the  transfer  of  the  installation. 

(U)  OSC-I  Enduring  Sites 

(U)  OSC-I  will  provide  training  and  advisory  services  to  the  Iraqi  military  and  police  after 
the  withdrawal  of  U.S.  forces  in  Iraq.  For  the  OSC-I  enduring  sites,  which  will  remain 
under  DoD  management,  PSCs  will  continue  to  provide  perimeter  and  internal  security 
services  under  new  contracts.  Although  the  new  contracts  have  been  awarded,  as  of 
May  19,  201 1,  the  task  orders  were  not  issued  and  it  is  not  known  if  the  present  PSCs  will 
continue  to  provide  security  at  these  sites  or  if  there  will  be  a  new  contractor.  C-JTSCC 
officials  stated  that  if  there  is  a  change  in  PSC,  there  will  be  a  period  of  overlap  between 
the  incumbent  and  incoming  contractors.  C-JTSCC  officials  stated  that  the  transition 
period  is  intended  to  avoid  disruption  in  security  services. 

(U)  Department  of  State  Enduring  Sites 

(U)  U.S.  military  sites  transferring  from  DoD  to  Department  of  State  will  be  handled  in  a 
similar  manner  to  the  OSC-I  locations.  However,  according  to  C-JTSCC  officials,  there 
may  be  challenges  regarding  the  level  of  security  services  provided  under  Department  of 
State  management.  C-JTSCC  contracting  officials  stated  that  the  timeline  for  the  transfer 
from  DoD  to  the  Department  of  State  may  slip.  According  to  DoD  officials,  the  current 
PSC  contracts  can  be  adjusted  to  accommodate  for  this  delay. 

(U)  Summary 

(U)  The  PSCs  were  aware  of  their  contractual  requirements  and  worked  to  meet  these 
requirements.  While  we  identified  minor  problems  with  training  requirements  and 
weapons  qualifications,  these  represented  approximately  2  percent  of  the  files  we 
reviewed.  We  believe  the  low  number  of  problems  in  the  personnel  files  is  directly 
attributable  to  the  relationship  demonstrated  between  PSC  managers  and  DoD  officials 
performing  oversight.  Throughout  our  review,  we  noticed  examples  of  PSC  managers 
working  with  the  BDOCs,  CORs,  and  DCMA-I  quality  assurance  representatives  to  ensure 
that  contract  requirements  were  met  and  the  security  services  provided  aligned  with  the 
security  requirements  established  by  the  BDOCs.  When  changes  were  necessary,  the  PSCs 
worked  with  DoD  officials  to  make  the  required  adjustments.  We  did  not  identify  any 
major  areas  of  noncompliance  in  the  PSC  performance  or  DoD  oversight  of  the  TWISS 
contracts  we  reviewed. 
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(U)  Finding  B.  Private  Security  Contractors 
May  Not  Deter  Attacks  on  OSC-I  Enduring 
Sites 

(S)1  The  PSC  guards  did  not  always  deter  insurgents  from  attacking  military  installations  in 
Iraq,  as  the  security  requirements  in  the  private  security  contract  were  not  adequate. 
Specifically,  U.S.  military  commanders  at  5  of  30  installations3  in  Iraq  using  PSC  guards 
supplemented  the  PSC  guards  providing  perimeter  security  with  military  guards  in  times  of 
heightened  threats.  Also,  PSC  guards  did  not  return  fire  on  insurgents  during  two  separate 
attacks.  This  occurred  because  contract  restrictions  and  international  agreements  limited 
the  ability  of  the  PSCs  to  react  to  threats,  specifically: 

•  (U)  the  contracts  limited  the  number  of  PSC  guards  for  each  installation  and  did 
not  allow  for  a  surge  capability, 

•  (U)  contract  clauses  and  international  agreements  placed  restrictions  on  when  and 
how  PSC  guards  can  use  their  weapons  in  response  to  threats,  generally  requiring  a 
graduated  force  response  to  threats,  and 

•  (U)  international  agreements  made  the  PSCs  subject  to  Iraqi  jurisdiction  for  acts 
considered  to  be  criminal. 

(U)  While  U.S.  forces  were  in  Iraq,  military  members  supplemented  the  PSCs  and 
mitigated  these  security  concerns.  However,  after  the  U.S.  military  forces  withdrew  from 
Iraq  in  December  2011,  the  PSC  guards  became  the  primary  deterrent  to  prevent  attacks  on 
the  enduring  sites.  Without  the  military  presence,  the  PSCs  may  not  be  able  to  deter 
attacks  on  the  OSC-I  enduring  sites,  and  the  SSS-I  contracts4  further  limits  the  guards’ 
deterrence  by  removing  the  responsibility  of  the  PSC  guards  to  respond  to  attacks.  As  a 
result,  U.S.  Government  and  contractor  personnel  and  assets  will  likely  be  at  an  increased 
risk. 

(U)  Contractors’  Role  Under  the  TWISS  Contracts 

(U)  While  the  PSCs’  role  under  the  TWISS  contracts  is  to  supplement  and  augment 
BDOC  established  security  activities  at  U.S.  installations  in  Iraq,  there  have  been  instances 
in  which  military  commanders  determined  that  military  units  were  needed  to  supplement 
the  PSCs  to  provide  adequate  security  for  the  installation.  These  instances  included 
periods  of  heightened  threat  and  direct  attacks  at  one  installation. 


Only  30  of  the  33  military  commanders  responded  to  our  questionnaire  related  to  military  members 
supplementing  the  PSC  guards. 

4  (U)  The  SSS-I  contracts  will  be  used  to  provide  security  at  the  OSC-I  enduring  sites  in  Iraq. 
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(U)  PSCs  Require  Augmentation  During  Periods  of  Heightened 
Threats 

fS}  U.S.  military  commanders  at  30  of  the  33  installations  with  PSC  guards,  responded  to 
our  questionnaire  on  their  performance.  According  to  the  responses  received  to  our 
questionnaire,  the  military  commanders  at  five  of  these  installations  deemed  it  necessary  to 
supplement  the  PSC  guards  with  military  units  in  times  of  heightened  threats.  According 
to  BDOC  personnel,  the  contracts  limit  the  ability  of  PSCs  to  respond  to  changing  threat 
levels.  While  the  contracts  had  some  flexibility  in  the  distribution  of  PSC  guards,  the 
authorized  manning  levels  and  requirements  were  fixed  and  could  not  be  altered  without 
contract  modification.  Therefore,  BDOC  personnel  could  not  alter  the  total  number  of 
PSC  guards  at  each  installation.  When  the  BDOC  determined  that  the  threat  level 
increased  sufficiently  to  warrant  additional  perimeter  PSC  guards,  the  only  options  were  to 


IDoDOIG:  (b)(7)(F) 


supplement  with  U.S.  military  forces. 


(U)  Contractors  Did  Not  Return  Fire  on  insurgents 

While  the  majority  of  attacks  on  U.S.  installations  were  indirect  fire,  there  were  direct 
attacks  on  the  PSC  guards.  Specifically,  insurgents 
launched  attacks  using  long  range  rockets  and 
mortars,  which  the  PSC  guards  cannot  defend 
against.  On  January  4,  201 1,  and  March  20,  2011, 
attacks  at  Joint  Security  Station  (JSS)  Loyalty, 
insurgents  fired  rocket  propelled  grenades  at  guard 
towers,  causing  damage  to  the  towers  and  injury  to 
the  PSC  guards.  In  both  instances,  the  PSC  guards 
did  not  return  fire  on  the  insurgents. 

During  both  attacks,  the  PSC  guards 
immediately  took  cover  and  were  found  on  the  lower  level  of  the  guard  towers.  In  the  first 
attack,  the  guards  stated  that  they  did  not  have  time  to  prepare  their  weapons  for  firing. 
Military  officials  questioned  whether  the  PSC  guards  would  return  fire,  even  if  they  had 
time  to  prepare.  Officials  also  stated  that  the  PSC  guards  are  familiar  with  the  RUF  and 
aware  that  they  would  be  subject  to  Iraqi  jurisdiction  if  they  fired  their  weapon  even  if  in 
self  defense.  Military  officials  stated  that  they  believed  this  caused  the  guards  to  hesitate 
firing  their  weapons,  and  they  viewed  the  PSC  guards  as  only  an  “early  warning  system” 
that  would  report  attacks  or  suspicious  individuals.  As  a  result,  U.S.  military  personnel 
were  used  to  augment  the  PSCs  in  guarding  the  installation. 


ffif  On  January  4,  2011,  and 
March  20,  2011,  attacks  at 
Joint  Security  Station  (JSS) 
Loyalty,  insurgents  fired 
rocket  propelled  grenades  at 
guard  towers...  In  both 
instances,  the  PSC  guards 
did  not  return  fire  on  the 
insurgents. 


■fS}  On  April  19,  201 1,  the  administrative  contracting  officer  issued  a  letter  of  concern  to 
the  PSC  requiring  changes  to  the  JSS  Loyalty  SOPs.  According  to  the  JSS  Loyalty  BDOC, 
the  SOPs  in  place  at  the  time  of  the  attacks  instructed  the  guards  to  take  cover  when 
attacked  and  report  the  attack  to  the  BDOC.  The  letter  of  concern  instructed  the  PSC  to 
change  the  SOPs  to  require  the  guards  to  return  fire,  in  accordance  with  the  RUF,  when 
attacked. 
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(U)  Limitations  on  Contractors’  Response 

(U)  Restrictions  and  limitations  in  the  contracts  and  international  agreements  limit  the 
response  of  the  PSCs  to  changing  security  needs  and  threats.  The  contracts  restrict  the 
PSC  guards’  ability  to  use  force  in  response  to  threats  and  limit  the  flexibility  in  the 
number  of  guards  available  to  manage  changes  in  the  manning  tables  as  threat  levels 
change.  Specifically,  the  contracts  place  limits  on  the  number  of  personnel  the  PSC  is 
authorized  to  employ,  reducing  their  ability  to  respond  to  changes  in  threat  levels.  In 
addition,  PSC  guards  follow  the  RUF  which  places  restrictions  on  when  they  are  allowed 
to  fire  their  weapons,  and  international  agreements  place  the  PSC  guards  under  Iraqi 
jurisdiction  for  crimes,  which  may  cause  the  guards  to  be  hesitant  to  return  fire, 

(U)  Number  of  PSC  Guards  Allowed 

(U)  The  task  order  performance  work  statement  (PWS)  of  the  TWISS  contracts  outlines 
the  types  of  posts  and  operating  hours,  and  the  required  manning  for  day  and  night 
operations.  Although  the  task  order  PWS  stated  that  because  of  mission  dynamics  the 
U.S.  Government  anticipates  an  unknown  level  of  growth  in  the  amount  of  contracted 
security  services  required,  there  is  no  capability  for  the  PSC  guard  force  to  surge  in  times 
of  heightened  threat.  According  to  a  PSC  official,  he  could  adjust  the  manning 
requirements  by  moving  PSC  guards  around  as  security  operations  dictate.  However,  this 
could  only  be  done  on  a  temporary  basis  as  the  total  number  of  PSC  guards  does  not 
change.  To  increase  the  number  of  PSC  guards  at  an  installation,  the  administrative 
contracting  officer  should  negotiate  a  surge  capability  with  the  contractor  and  issue  a 
contract  modification.  While  U.S.  military  forces  remained  in  Iraq,  they  were  used  to 
provide  additional  security  during  periods  of  heightened  threat.  When  these  forces 
drawdown,  the  PSCs  will  need  to  have  the  flexibility  in  manning  to  respond  to  periods  of 
heightened  threat,  While  we  are  not  making  specific  recommendations  for  the  TWISS 
contracts,  the  recommendation  in  this  report  could  prevent  security  weaknesses  under  the 
SSS-I  contracts  at  OSC-I  enduring  sites. 

(U)  RUF  Require  a  Graduated  Response 

According  to  the  TWISS  contract,  under  the  RUF,  the  PSC  guards  may  use  deadly 
force  “in  self-defense  or  defense  of  others  when  there  is  a  reasonable  belief  of  imminent 
threat  of  death  or  serious  bodily  harm.”  However,  under  other  situations,  they  must  use  a 
graduated  force  response.  A  graduated  force  response  includes  giving  a  verbal  warning 
(“Shout”),  showing  their  weapons  and  demonstrating  an  intent  to  use  them  (“Show”), 
physically  detaining  or  otherwise  preventing  an  individual  from  gaining  access  to  the 
installation  (“Shove”  —  not  applicable  to  the  tower  guards),  and  only  after  these  prior 
efforts  are  the  guards  allowed  to  fire  their  weapons  (“Shoot”).  Also,  under  the  RUF,  PSC 
guards  are  not  allowed  to  fire  warning  shots. 

The  rules  discussed  above  could  hinder  PSC  guards’  response  to  potential  attacks 
because  the  imminent  threats  were  not  clearly  defined  in  the  contracts.  For  example, 
according  to  a  PSC  official,  if  tower  guards  identified  a  person  with  a  rocket  propelled 
grenade  who  was  not  actively  aiming  at  the  installation,  the  PSC  guards  were  not  allowed 
to  shoot  at  the  suspect  in  accordance  with  the  RUF.  Instead,  the  PSC  guards  should  report 
the  situation  to  the  BDOC  and  continue  to  monitor  the  potential  threat.  Later  on,  if  the 
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suspect  aimed  a  rocket  propelled  grenade  at  the  tower  or  the  installation,  the  situation 
became  an  imminent  threat.  The  PSC  guards  can  then  fire  upon  the  attacker  in  self-defense 
or  in  defense  of  others. 

In  another  example,  if  an  individual  scaled  a  perimeter  wall  unarmed,  he  might  not 
represent  an  immediate  threat.  However,  his  bulky  dress  could  indicate  that  he  is  a  suicide 
bomber.  Because  it  is  impractical  to  define  every  instance  that  would  be  considered  an 
imminent  threat,  the  PSC  guards  must  determine  whether  an  individual  poses  an  imminent 
threat,  and  whether  they  are  required  to  follow  the  RUF.  The  uncertainty  of  what  is 
considered  an  imminent  threat  may  cause  the  guards  to  delay  their  response  to  an  attack. 

(U)  Contractor  Guards  Subject  to  Iraqi  Jurisdiction 

(U)  According  to  an  international  agreement  between  the  governments  of  the  United 
States  and  Iraq,  U.S.  military  forces  and  DoD  civilians  are  not  subject  to  Iraqi  criminal  and 
civil  law  while  performing  normal  duties.  However,  the  Iraqi  Government  has  the  primary 
right  to  exercise  jurisdiction  over  U.S.  contractors  and  contractor  employees.  According  to 
a  PSC  official,  the  PSC  guards  were  aware  that  if  they  fired  upon  Iraqi  civilians,  they 
would  be  subject  to  Iraqi  jurisdiction  and  could  be  tried  and  imprisoned  in  Iraq.  Another 
senior  DoD  contracting  official  also  stated  that  if  the  PSC  guards  shot  an  insurgent  on  the 
scene,  they  could  face  a  trial  in  Iraqi  court.  Although  we  do  not  have  specific  examples  in 
which  the  PSC  guards  did  not  return  fire  because  of  the  fear  of  Iraqi  jurisdiction,  military 
officials  expressed  concern  that  this  is  causing  a  delay  in  the  PSC  guards’  response  to 
attacks.  While  a  change  to  the  international  agreement  is  unlikely,  by  including  language 
in  the  contracts  or  task  orders  requiring  the  PSC  guards  to  engage  insurgents  who  are 
attacking  the  installation  and  endangering  the  lives  of  the  PSCs  and  U.S.  Government 
personnel,  this  hesitance  could  be  mitigated.  Although  we  are  not  making  a 
recommendation  to  specifically  address  this  issue,  the  recommendation  made  should 
mitigate  the  risk. 

(U)  Contractors’  Ability  to  Deter  Attacks  at  OSC- 1 
Enduring  Sites 

Since  the  drawdown  of  U.S.  military  forces  from  Iraq,  PSCs  are  play  an  increasingly 

important  role  in  the  security  at  OSC-I  enduring  sites. 
Without  the  U.S.  military  as  a  backup,  the  PSCs  are  the 
primary  deterrent  against  attacks  on  the  OSC-I  enduring 
sites.  However,  without  the  flexibility  to  respond  to 
changing  threat  levels  and  to  require  a  defensive  response 
to  attacks,  the  PSC  guards  will  not  be  able  to  deter  attacks, 
and  U.S.  Government  and  contractor  personnel  and  assets 
will  likely  be  at  an  increased  risk  of  terrorist  attack. 

(U)  U.S.  Military  Presence  in  Iraq  After  December  201 1 

In  accordance  with  the  agreement  between  the  U.S.  Government  and  the  Government 
of  Iraq,  U.S.  Forces  withdrew  from  Iraq  in  December  2011.  There  is  a  small  contingent  of 
U.S.  military  personnel  at  the  OSC-I  sites.  However,  the  military  personnel  will  be 
responsible  for  overseeing  and  administering  the  ongoing  training  programs  for  the  Iraqi 


Without  the  U.S. 
military  as  a  backup,  the 
PSCs  will  be  the  primary 
deterrent  against  attacks 
on  the  OSC-I  enduring 
sites. 
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(S}  Army  and  Federal  Police.  Military  units  are  not  available  to  support  or  augment  the 
PSCs  in  the  defense  of  the  OSC-I  sites.  The  PWS  in  the  SSS-I  contracts  states  that  the 
PSC  must  maintain  flexibility  to  adjust  to  changing  threat  environments.  However, 
excluding  the  option  to  adjust  the  number  of  PSC  guards  from  the  task  order,  limits  the 
contractor’s  ability  to  respond  to  heightened  threat  levels. 

fS)-  Military  Officials  Express  Concerns  Over  Contractor  Guards' 
Response  to  Attacks 

Military  commanders  expressed  concerns  regarding  the  ability  of  the  PSCs  to  deter 
attacks  on  the  installations,  hi  the  two  direct  fire  incidents  at  JSS  Loyalty,  command 
personnel  raised  questions  concerning  the  willingness  of  the  contractors  to  return  fire.  In 
the  conclusion  of  the  incident  report  for  the  first  of  the  direct  fire  attacks  at  the  installation, 
the  BDOC  Commander  stated, 

the  major  concern  arising  from  this  attack  is  the  culture  that  is  present  in  the  [PSC] 
organization.  A  culture  of  hesitation  and  even  an  unwillingness  to  fire  their  weapons.  There  are 
many  examples  throughout  the  SOP  that  discourages  the  use  of  deadly  force.  This  hesitation  and 
weapon  posture  aided  the  enemy’s  successtul  attack  on  [Joint  Security  Station]  Loyalty.  The 
mentality  needs  to  be  changed  if  this  contract  is  to  be  beneficial  to  United  States  Forces.  Otherwise 
they  are  just  an  early  warning  system  and  not  the  first  line  of  defense  for  [Joint  Security  Station] 
Loyalty. 

The  JSS  Loyalty  Battalion  Commander  stated  that  without  a  response  to  the  attacks  on 
the  installation,  the  enemy  would  be  emboldened  to  continue  the  attacks.  He  also 
expressed  concern  that  the  lessons  the  insurgents  were  learning  through  their  attacks  at  JSS 
Loyalty  could  be  used  at  other  locations. 

(Sf  SSS-I raq  Contracts  Further  Limit  Contractor’s  Authority 

f&f  At  present,  the  PSCs  providing  security  at  installations  in  Iraq  operate  under  the 
TWISS  contracts.  However,  the  OSC-I  enduring 
sites  will  have  security  provided  under  the  SSS-I 
contracts,  which  were  signed  on  May  3,  201 1 .  The 
new  SSS-I  contracts  contain  different  requirements 
than  those  in  the  TWISS  contracts,  specifically  in 
regards  to  the  duties  performed  by  the  perimeter 
security  guards.  Under  the  present  TWISS  contracts, 
the  role  of  the  contractor  is  to  supplement  and 
augment  security  operations  at  the  installations.  The 
task  orders  and  SOPs  expanded  on  this  role,  requiring  the  PSCs  to  provide  assistance  in 
defending  the  installations.  Specifically,  the  task  orders  and  SOPs  required  the  PSCs  to 
defend  the  installation  from  hostile  action  and  return  fire  when  attacked.  The  SSS-I 
contracts  do  not  require  the  same  response  from  the  PSC  guards.  The  contracts  state  that 
the  static  (perimeter)  guards’  duties  are  to  control  access  to  the  installation,  perform 
vehicle  and  personnel  searches,  and  report  suspicious  persons.  The  contracts  do  not 
mention  the  defense  of  the  installation.  In  addition,  the  SSS-I  contracts  state  that  the  PSCs 
are  not  responsible  for  safeguarding  against  direct  fire,  indirect  fire,  or  terrorist  attacks. 
While  U.S.  forces  were  in  Iraq,  military  members  supplemented  the  PSCs  and  mitigated 


fSjl  The  SSS-I  contracts 
state  that  the  PSCs  are 
not  responsible  for 
safeguarding  against 
direct  fire,  indirect  fire, 
or  terrorist  attack. 
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these  security  issues.  As  of  December  2011,  military  members  are  no  longer  available 
to  supplement  the  PSC  guards.  Without  the  U.S.  military  as  support,  the  PSCs  must  be 
ready  to  respond  to  the  changing  threat  levels  in  order  to  ensure  they  can  accomplish  their 
mission.  However,  with  the  requirement  to  defend  the  installations  against  attacking 
insurgents  removed  from  the  new  SSS-I  contracts  and  the  lack  of  military  members  to 
show  force,  there  will  be  no  action  taken  to  deter  insurgents  from  attacking  the 
installations.  This  will  exacerbate  the  security  risks  at  the  enduring  sites  and  will  put  U.S. 
Government  and  contractor  personnel  and  assets  at  increased  risk  of  terrorist  attack.  A 
PSC  requirement  to  defend  the  installation  is  proper,  however,  only  to  the  extent  that  it  is 
consistent  with  the  PSCs  right  of  self  defense  and  the  defense  of  others. 

f£r)  On  June  6,  2011,  insurgents  again  attacked  JSS  Loyalty.  The  attack  was  launched 
from  a  truck  parked  outside  of  an  Iraqi  Federal  Police  base  that  is  adjacent  to  JSS  Loyalty. 
The  insurgents  fired  7,  240  millimeter  improvised  rockets  at  the  installation,  each  carrying 
150  to  200  pounds  of  explosives.  Of  the  7  rockets  fired,  5  struck  the  installation  killing  5 
U.S.  soldiers  and  wounding  17.  The  Iraqi  Federal  Police  fired  at  the  insurgents  from  an 
observation  tower,  driving  them  off.  However,  if  a  similar  attack  took  place  at  an  OSC-I 
enduring  site  in  front  of  the  PSC  guards,  according  to  the  new  SSS-I  contract,  the  guards 
would  not  be  required  to  return  fire  on  the  insurgents.  The  only  contractually-required 
duty  would  be  to  report  the  incident  to  the  installation  security  office. 

(U)  Recommendations,  Management  Comments,  and  Our 
Response 

(U)  B.  We  recommend  the  Commander,  U.S.  Central  Command  modify  the  Security 
Support  Services-Iraq  contract  to: 

(U)  1.  Include  a  surge  capability  to  allow  private  security  contractors  to  respond 
to  changing  threat  levels, 


(U)  U.S.  Army  Contracting  Command-Rock  Island  Comments 

(U)  The  Executive  Director,  U.S.  Army  Contracting  Command-Rock  Island,  responding 
for  the  Commander,  U.S.  Central  Command,  did  not  indicate  agreement  or  disagreement 


f S)  Our  Response 

The  comments  of  the  Executive  Director,  U.S.  Army  Contracting  Command-Rock 
Island  were  partially  responsive  to  part  B.  1  of  the  recommendation  and  did  not  frilly 
address  the  intent  of  the  recommendation.  Although  U.S.  combat  forces  have  departed, 
Iraq  remains  a  hostile  environment  and  PSCs  operating  in  that  environment  are  the  primary 
deterrent  against  attacks  on  U.S.  Government  personnel  and  assets.  The  PWS  for  the 
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SSS-I  contracts  states  that  the  PSCs  must  maintain  flexibility  to  adjust  to  changing 
threat  environment.  If  the  option  to  adjust  the  number  of  PSC  guards  is  not  included  in  the 
task  orders,  the  contractors’  ability  to  maintain  flexibility  and  respond  in  times  of 
heightened  threats  will  be  limited.  Excluding  a  surge  option  in  a  hostile  environment  could 
lead  to  great  risk  on  both  the  PSC  and  U.S,  Government  personnel  and  assets  in  Iraq. 
Planning  for  a  surge  capability  in  the  event  of  heightened  threats  could  help  establish  a 
response  process  to  dissuade  attackers  form  committing  hostile  acts  against  U.S. 
Government  personnel  and  assets  in  Iraq.  We  request  that  the  Commander,  U.S.  Central 
Command  reconsider  his  position  and  provide  comments  to  the  final  report  on 
recommendation  B.  1 . 

(U)  2.  Provide  additional  guidance  and  examples  of  situations  and  events  that 
should  be  considered  an  imminent  threat. 

(U)  U.S.  Army  Contracting  Command-Rock  Island  Comments 

(U)  The  Executive  Director,  U.S.  Army  Contracting  Command-Rock  Island  did  not 
respond  to  part  B.2  of  the  recommendation. 

(U)  Our  Response 

(U)  We  request  that  the  Commander,  U.S.  Central  Command  provide  comments  in 
response  to  part  B.2  of  the  recommendation  to  the  final  report. 


(U)  3.  Clarify  the  guards’  responsibility  to  engage  the  enemy  when  attacked. 


(U)  U.S.  Army  Contracting  Command-Rock  Island  Comments 

(U)  The  comments  of  the  Executive  Director,  U.S.  Army  Contracting  Command-Rock 
Island  were  partially  responsive  to  part  B.3  of  the  recommendation. 


Army  Sustainmenl 
Command:  (b)(5) 


(U)  Our  Response 

(U)  The  Executive  Director’s  comments  were  partially  responsive,  and  did  not  fully 
address  the  intent  of  our  recommendation,  which  was  not  to  encourage  performance  of 
inherently  governmental  functions,  but  to  clarify  the  guards’  responsibility  for  the  safety  of 
U.S.  Government  personnel  and  assets  in  Iraq. 


The  PWS  of  the  SSS-Iraq  contracts  includes  a  clear  distinction  between  the  PSCs 
responsibilities  and  inherently  governmental  functions.  The  PWS  states  that  contractors, 
“are  not,  under  any  circumstances,  to  be  involved  in  or  engage  in  offensive  operations  or 
use  tactics  that  provide  the  appearance  of  offensive  operations.”  This  statement  addresses 
the  intent  of  the  OMB  Letter  11-01,  which  states  that  contractors  are  not  to  engage  in 
combat  or  security  operations.  However,  OMB  Letter  11-01  also  states  that  contractors’ 
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■fS^  prohibition  from  combat  “should  not  be  interpreted  to  preclude  contractors  taking 
action  in  self-defense  or  defense  of  others  against  imminent  threat  of  death  or  serious 
injury.’’  The  PWS  for  the  SSS-I  contracts  further  states  that  “the  contractor  shall  only  be 
required  to  deploy  a  level  of  physical  security  protection  necessary  to  maintain  access 
control  of  the  sites  designated,  and  is  not  responsible  for  safeguarding  against  LEVEL  1 
threats  (for  example,  direct  fire,  terrorist  attacks,  and  indirect  fire).”  This  statement 
deviates  from  the  intent  of  the  SSS-I  contracts  and  will  create  uncertainties  in  PSC’s 
response  technique,  ability  to  respond  to  life  endangering  threats,  or  to  take  appropriate 
action  when  in  imminent  danger. 

(U)  hi  addition,  PSCs  are  armed  guards  operating  in  an  environment  with  constant  threat 
of  direct  fire,  terrorist  attacks,  and  indirect  fire.  Clarifying  the  guards’  responsibilities 
could  help  establish  control  and  accountability  if  the  guards  take  action  in  self  defense, 
response  to  imminent  danger,  actions  to  limit  installation  access  to  authorized  personnel 
only,  and  plans  to  protect  U.S.  Government  personnel.  Therefore,  we  ask  the  Commander, 
U.S.  Central  Command,  provide  comments  to  the  final  report  on  Recommendation  B.3. 
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(U)  Appendix  A.  Scope  and  Methodology 

(U)  We  conducted  this  performance  audit  from  January  20 1 1  through  December  2011  in 
accordance  with  generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to 
provide  a  reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 
We  believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 

(U)  To  accomplish  the  audit  objectives,  we  limited  our  review  to  the  contractor 
performance  in  meeting  security  requirements.  We  did  not  review  other  financial  aspects 
of  contract  administration.  We  identified  6  TWISS  contracts  and  81  task  orders  used  to 
provide  PSC  services  at  U.S.  installations  in  Iraq.  We  reviewed  the  contracts  to  determine 
whether  they  contained  required  Federal  Acquisition  Regulation  clauses,  and  judgmentally 
selected  two  sites  at  which  we  tested  contractor  compliance  with  contract  and  base  defense 
requirements,  including  training,  SOP  development,  and  security  control  measures.  We 
chose  to  visit  Victory  Base  Complex  and  Forward  Operating  Base  Hammer  based  on  the 
number  of  PSC  guards  and  the  company  providing  the  service.  Victory  Base  Complex  had 
the  largest  number  of  PSC  guards  and  Forward  Operating  Base  Hammer  had  a  different 
PSC  company.  We  evaluated  the  management  and  oversight  of  PSCs  at  the  two  sites 
visited.  During  our  site  visits,  we  reviewed  PSC  personnel  records  to  determine  whether 
the  PSC  guards  had  received  the  required  training  and  certifications.  At  Victory  Base 
Complex,  we  relied  on  a  nonjudgmental  sample  to  review  the  personnel  files.*  At  Forward 
Operating  Base  Hammer,  we  reviewed  all  of  the  personnel  files  for  the  PSC  employees. 

We  developed  a  checklist  of  required  activities  for  ECPs  and  towers,  and  performed  site 
inspections  to  ensure  the  required  work  was  being  performed.  We  reviewed  manning 
documents  to  ensure  that  the  PSC  guards  required  at  each  location  were  present  and 
performing  the  duties  assigned.  We  also  visited  organizations  associated  with  the 
management  and  oversight  of  PSCs  (see  the  table  below  for  a  listing  of  locations  visited). 


(U)  Table.  Listing  of  Site  Visits 


Site  Location 

Entities  Visited 

Victory  Base  Complex  ] 

1 

BDOC  | 

COR  i 

Administrative  Contracting  Officer 

PSC  Management  i 

Forward  Operating 

Base  Hammer 

BDOC  ! 

COR 

DCMA  Quality  Assurance 

PSC  Management 

*  (U)  See  Appendix  C  for  a  full  discussion  of  the  statistical  sample 
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(U)  We  interviewed  DCMA-I  officials  and  CORs  to  determine  the  level  of  oversight 
performed  in  regards  to  the  PSCs’  performance,  and  obtained  and  reviewed  records  of  this 
oversight,  including  site  inspection  reports,  manning  reports,  and  site  visit  calendars.  We 
met  with  force  protection  officials  within  USF-I  and  the  individual  installations  to  discuss 
security  requirements.  To  determine  the  number  of  installations  that  supplemented  the 
PSC  guards  with  military  units,  we  sent  a  questionnaire  to  all  33  installations  that  had 
PSCs  providing  security  services.  Finally,  we  met  with  C-JTSCC  officials  to  discuss  the 
drawdown  of  U.S.  forces  from  Iraq  and  the  effect  this  will  have  on  the  PSCs. 

(U)  We  performed  an  additional  site  visit  to  JSS  Loyalty  after  the  direct  fire  incidents  at 
that  installation.  During  that  site  visit,  we  met  with  command  personnel,  the  BDOC 
commander,  and  PSC  representatives.  We  obtained  and  reviewed  incident  reports  and 
performed  inspections  of  the  towers  that  had  come  under  attack. 

(U)  We  obtained  and  reviewed  policies  and  procedures  for  the  award,  management,  and 
oversight  of  private  security  contracts.  We  also  reviewed  the  following  DoD  instructions, 
orders,  and  other  guidance  related  to  the  management,  oversight,  and  performance  of 
PSCs: 

•  (U)  Federal  Acquisition  Regulations  and  Defense  Federal  Acquisition 
Regulation  Supplement; 

•  (U)  DoD  Instruction  5200. 8-R,  “Physical  Security  Program,”  April  9,  2007; 

•  (U)  DoD  Instruction  3020.41,  “Contractor  Personnel  Authorized  to 
Accompany  the  U.S.  Armed  Forces,”  October  3,  2005; 

•  (U)  “Agreement  Between  the  United  States  of  America  and  the  Republic  of 
Iraq  On  the  Withdrawal  of  United  States  Forces  from  Iraq  and  the  Organization 
of  Their  Activities  during  Their  Temporary  Presence  in  Iraq,” 

November  17,  2008;  and 

•  (U)  Multinational  Force- Iraq  Fragmentary  Order  09-109, 

“Armed  Contractors/DoD  Civilians  and  PSC,”  March  7,  2009. 

(U)  Use  of  Computer-Processed  Data 

(U)  We  did  not  use  computer-processed  data  during  this  audit. 

(U)  Use  of  Technical  Assistance 

(U)  The  DoD  Office  of  Inspector  General  Quantitative  Methods  and  Analysis  Division 
(QMAD)  assisted  with  the  audit.  For  our  review  of  the  PSC  compliance  with  contract 
requirements  at  Victory  Base  Complex,  the  QMAD  developed  the  sample  size  and  selected 
the  sample  population  of  contractors  for  review.  We  reviewed  the  personnel  files  for  this 
sample  to  determine  if  the  personnel  files  were  complete  and  the  contractor  guards  had 
received  the  required  training.  See  Appendix  C  for  detailed  information  about  the  work 
QMAD  performed. 
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(U)  Appendix  B.  Prior  Coverage 

(U)  During  the  last  5  years,  the  Government  Accountability  Office  (GAO),  the  Special 
Inspector  General  for  Iraq  Reconstruction  (SIGIR),  and  U.S.  Agency  for 
International  Development  (USAID)  have  issued  1 3  reports  discussing  the  use  of  private 
security  contractors  at  U.S.  military  installations  in  Iraq.  Unrestricted  GAO  reports  can  be 
accessed  over  the  Internet  at  http://www.gao.gov.  Unrestricted  SIGIR  reports  can  be 
accessed  at  http://www.sigir.mil/directorates/audits/auditReports.html. 

Unrestricted  USAID  reports  can  be  accessed  over  the  internet  at 
http://www.usaid.gov/oig/public/fv09rpts/fv09rptsl.html 

(U)  GAO 

(U)  GAO  Report  No.  GAO-09-351,  “DoD  Needs  to  Develop  and  Finalize  Background 
Screening  and  Other  Standards  for  Private  Security  Contractors,”  July  2009 

(U)  GAO  Report  No.  GAO-O 8 -966,  “DoD  and  State  Department  Have  Improved 
Oversight  and  Coordination  of  Private  Security  Contractors  in  Iraq,  but  Further  Actions 
Are  Needed  to  Sustain  Improvements,”  July  2008 

(U)  GAO  Report  No.  GAO-O 8-5 72T,  “DoD  Needs  to  Reexamine  Its  Extensive  Reliance 
on  Contractors  and  Continue  to  Improve  Management  and  Oversight,”  March  1 1, 2008 

(U)  GAO  Report  No.  GAO-06-865T,  “Actions  Still  Needed  to  Improve  the  Use  of  Private 
Security  Providers,”  June  13,  2006 

(U)  SIGIR 

(U)  SIGIR  11-015,  “Gulf  Region  District  Is  Adjusting  Its  Aegis  Security  Contract 
Requirements  for  Changes  in  Reconstruction  Activities  in  Iraq,”  April  27, 2011 

(U)  SIGIR  09-023,  “Investigation  and  Remediation  Records  Concerning  Incidents  of 
Weapons  Discharges  By  Private  Security  Contractors  Can  Be  Improved,”  July  28,  2009 

(U)  SIGIR  09-022,  “Field  Commanders  See  Improvements  in  Controlling  and 
Coordinating  Private  Security  Contractor  Missions  In  Iraq,”  July  28,  2009 

(U)  SIGIR  09-019,  “Opportunities  To  Improve  Processes  For  Reporting,  Investigating, 
and  Remediating  Serious  Incidents  Involving  Private  Security  Contractors  In  Iraq,” 

April  30,  2009 

(U)  SIGIR  09-014,  “Security  Forces  Logistics  Contract  Experienced  Cost,  Outcome,  and 
Oversight  Problems,”  April  26,  2009 

(U)  SIGIR-09-017,  “Need  to  Enhance  Oversight  of  Theater- Wide  Internal  Security 
Services  Contracts,”  April  24,  2009 
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(U)  SIGIR-09-010,  “Oversight  of  Aegis  Performance  on  Security  Services  Contracts  in 
Iraq  with  the  Department  of  Defense,”  January  14,  2009 

(U)  SKHR-09-005,  “Agencies  Need  Improved  Financial  Data  Reporting  For  Private 
Security  Contractors,”  October  30,  2008 

(U)  USAID 

(U)  Audit  Report  No.  E-267-09-002-P,  “Audit  of  USAID/IRAQ’S  Oversight  of  Private 
Security  Contractors  In  Iraq,”  March  4,  2009 
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(U)  Appendix  C.  Statistical  Sample 

(U)  Population 

(U)  The  universe  consisted  of  229  ex-patriots  and  1,806  third-country  nationals  employed 
by  the  PSC  at  Victory  Base  Complex. 

(U)  Measures 

(U)  We  used  an  attribute  measure  of  correct  or  incorrect  that  is  their  file  was  or  was  not 
with  them  and  whether  or  not  the  personnel  files  contained  records  of  the  required  training. 

(U)  Parameters 

(U)  We  used  a  90-percent  confidence  interval. 

(U)  Sample  Plan 

(U)  We  used  a  simple  random  sample  design.  The  QMAD  analysts  provided  a  random 
sample  of  60  ex-patriots  and  87  third-country  nationals  for  review.  We  reviewed  the 
personnel  files  for  the  individuals  selected  in  the  sample  to  determine  whether  the  training 
required  by  the  contract  was  completed,  timely,  and  identifiable  in  the  personnel  files. 

(U)  Analysis  and  Interpretation 

(U)  According  to  the  PSC  manager,  not  all  of  the  positions  require  the  guards  to  carry 
weapons.  Because  of  the  difficulty  in  identifying  which  positions  require  weapons  and 
identifying  the  individual  PSC  guards  manning  those  positions,  we  determined  it  would  not 
be  an  effective  use  of  resources  to  match  the  individuals  against  positions  requiring 
weapons.  During  our  review,  we  found  one  ex-patriot  and  four  third-country  nationals 
who  did  not  have  a  current  weapon  qualification. 

(U)  Based  on  our  analysis  of  the  personnel  files,  we  identified  one  ex-patriot  file  that  did 
not  contain  records  of  the  required  training.  Projecting  this  to  the  population,  we  are 
90  percent  confident  that  there  are  no  more  than  10  (or  4.6  percent)  of  the  ex-patriots  with 
deficient  training  records  in  the  population  of 229.  We  did  not  identify  any  third-country 
nationals  that  were  missing  training  records.  We  discussed  the  training  records  with  the 
PSC  managers,  who  agreed  to  take  immediate  action  to  ensure  the  files  were  complete. 

(U)  We  were  not  able  to  review  three  files  for  the  ex-patriots.  Projecting  this  to  the 
population,  we  are  90  percent  confident  that  there  are  no  more  than  21  (or  9.2  percent)  of 
the  individuals  with  missing  files  in  the  population  of  229.  Of  the  three  sample  items 
missing,  one  file  was  being  transferred  between  agencies  at  the  time  of  the  review.  The 
second  file  was  taken  by  the  employee  when  he  left  the  company.  The  third  was  taken 
with  the  employee  while  he  was  on  leave.  For  the  third-country  nationals,  we  were  not 
able  to  review  the  personnel  files  for  two  of  the  sample  items.  Projecting  this  to  the 
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(U)  population,  we  are  90  percent  confident  that  there  are  no  more  than  91  (or  5.1  percent) 
of  the  population  of  1,806  that  are  missing  personnel  files.  For  the  two  items  in  our 
sample,  PSC  managers  stated  the  two  guards  missing  files  were  new  employees  and  the 
personnel  files  did  not  arrive  from  the  PSC’s  headquarters. 


SECRET 

22 


SECRET 


(U)  Appendix  D.  List  of  Classified 
Documents 

n  “Attacks  on  Bases,  Incident  Reports,  and  Survey  Results" 

Declassification  Date:  June  14,  2036 
Generated  Date:  June  14,  2011 

fS)-  “RPG  Attack  on  USF  in  COS  Loyalty” 

Declassification  Date:  January  5,  2036 
Generated  Date:  January  5,  201 1 

“RPG  Attack  Targeting  COS  Warrior” 

Declassification  Date:  January  23,  2036 
Generated  Date:  January  23, 201 1 

“RPG  Attack  on  COL  Loyalty” 

Declassification  Date:  March  20,  2036 
Generated  Date:  March  20,  2011 

“RPG  Attack  Targeting  COL  Loyalty” 

Declassification  Date:  April  15,  2036 
Generated  Date:  April  15,2011 

fS)  “IRAM  Attack  Targeting  COL  Loyalty” 

Declassification  Date:  June  7, 2036 
Generated  Date:  June  7, 20 1 1 

f&T  “Responses  to  DoDIG  Questionnaire” 

Declassification  Date:  June  5, 2036 
Generated  Date:  June  5, 201 1 

fS)-  “Report  of  Proceedings  by  Investigation  Officer/Board  of  Officers” 

Declassification  Date:  January  21,  2036 
Generated  Date:  January  21,  201 1 

fSjf  Briefing  Charts,  “Engineering  Excellence  in  the  IJOA  U.S.  Forces  -  Iraq,  Operation 

New  Dawn” 

Declassification  Date:  January  28,  2036 
Generated  Date:  January  28,  201 1 
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(U)  U.S.  Central  Command  Comments 
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UNCLASSIFIED 

DEPARTMENT  OF  THE  ARMY 
ARMY  CONTRACTING  COMMAND  -  ROCK  ISLAND 
1  ROCK  ISLAND  ARSENAL 
ROCK  ISLAND,  IL  $1296.5000 


JAN  2  6  2012 


MEMORANDUM  FOR  Commander,  Joint  Theater  Support  Contracting 
Command  (C-JTSCC)  ,  Camp  As  Sayliyah,  APO  AE  09898 

SUBJECT:  Army  Contracting  Command-Rook  Island  (ACC-RI) 
Recommendations  to  DoDIG  Report 

1.  Army  Contracting  Command  Rook  Island  (ACC-RI)  received  an 
email  from  USCENTCOM  HQ  CCJ4-C  (CCJ4-C)  on  11  January  2012, 
requesting  that  ACC-RI  respond  to  a  Department  of  Defense 
Inspector  General  (DODIG)  report  titled,  "DOD  Oversight  of 
Private  Security  Contractors  in  Iraq  was  Sufficient,  but 
Contractors  May  Not  Deter  Attacks  on  OSC-I  Enduring  Sites . "  The 
CCJ4-C' a  email  request  to  ACC-RI  inaluded  a  Memorandum  For  Record 
(MFR)  from  CENTCOM  Joint  Theater  Support  Contracting  Command  (C- 
JTSCC)  Chief  of  Staff  dated  09  January  2012 .  This  MFR  stated  that 
“USCENTCOM  no  longer  has  jurisdiction  in  Iraq. "  The  MFR  also 
stated,  “The  Seourity  Support  Services- Iraq  (SSS-I)  contract  is  • 
ourrently  administered  by  Rock  Island  and  falls  under  the  HCA 
authority  of  Mr.  Mike  Hutchison." 

2.  The  MFR  incorrectly  asserts  that  USCENTCOM  has  no  authority  in 
Iraq.  Commander  USCENTCOM  has  Title  10  United  Staten  Code 
(U.S.C.)  authority  for  Iraq,  including  but  not  limited  to  the 
authority  to  oontraat.  USCENTCOM' s  Title  10  U.S.C.  authority  to 
contract  is  delegated  to  Rear  Admiral  Kalathas,  Commander  C- 
JTSCC,  as  Head  of  Contracting  Activity  (HCA)  ,  In  a  delegation 
letter  dated  21  Oatober  2011,  Rear  Admiral  Kalathas  delegated  his 
HCA  authority  for  contracting  to  Mr.  Miohael  (Mike)  Hutchison, 
ACC-RI  Principal  Assistant  Responsible  for  Contracting  (PARC) . 
USCENTCOM  retains  its  Title  10  U.S.C.  contracting  authority  and 
responsibilities  despite  the  delegation  to  Mr,  Hutchison.  The 
sss-I  contract  is  ourrently  administered  by  Rook  Island,  and  the 
SSS-I  Procuring  Contracting  Officer  (PCO)  has  provided  a  response 
to  the  DODIG  report  recommendations  below, 

3.  Recommendation:  Seourity  contracts  should  include  a  surge 
option  in  order  to  respond  to  increased  threat  levels. 

ACC-RI  Comment: 


[Army  Sustainment  Command:  (b)(5) 
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CCRC 

SUBJECT:  Array  Contracting  Command-Rook  Island 
Recommendations  to  DoDIG  Report 


JAW  2  6  2012 

(ACC-RI) 


should  bo  sought  regarding  the  potential  for  the  operations 
to  evolve  into  combat. 

(e)  Security  that  entails  augmenting  or 
reinforoing  others  (whether  private  security  contractors, 
civilians,  or  military  units)  that  have  become  engaged  in 
combat . " 


Zt  is  ACC-Rl's  position  that  contractually  authorising  the 
security  contractors  to  use  greater  levels  of  force  is  likely  to 
result  in  the  contractor  providing  services  that  have  been 
defined  as  inherently  governmental. 


5 .  Please  contact 
have  further  questions. 


if  you 


i  /  ,|  , 

Ulkuu  A-  "}t  > 


AJ  (/<■■  <'l ttUld/'f \.; 

I  flICHAEL  R.  HUTCHISON/ 
til. Executive  Director 

0  Army  Contracting  Command -Rock  Island 
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